Forgot your password?
typodupeerror
Botnet Security IT

Botnets Using Ubiquity For Security 95

Posted by kdawson
from the whack-a-c-and-c dept.
Trailrunner7 sends in this excerpt from Threatpost: "As major botnet operators have moved from top-down C&C infrastructures, like those employed throughout the 1990s and most of the last decade, to more flexible peer-to-peer designs, they also have found it much easier to keep their networks up and running once they're discovered. When an attacker at just one, or at most two, C&C servers was doling out commands to compromised machines, evading detection and keeping the command server online were vitally important. But that's all changed now. With many botnet operators maintaining dozens or sometimes hundreds of C&C servers around the world at any one time, the effect of taking a handful of them offline is negligible, experts say, making takedown operations increasingly complicated and time-consuming. It's security through ubiquity. Security researchers say this change, which has been occurring gradually in the last couple of years, has made life much more difficult for them. ... Researchers in recent months have identified and cleaned hundreds of domains being used by the Gumblar botnet, but that's had little effect on the botnet's overall operation."
This discussion has been archived. No new comments can be posted.

Botnets Using Ubiquity For Security

Comments Filter:
  • by AHuxley (892839) on Monday June 07, 2010 @11:46PM (#32492198) Homepage Journal
    http://www.acma.gov.au/WEB/STANDARD..PC/pc=PC_310317 [acma.gov.au]
    "The AISI collects data from various sources on computers exhibiting 'bot' behaviour on the Australian internet.
    Using this data, the ACMA provides daily reports to ISPs identifying IP addresses on their networks that have been
    reported in the previous 24-hour period.
    ISPs can then inform their customer that their computer appears to be compromised and provide advice on how they can fix it."

    The only question seems to be when will p2p be seen as a botnet, limewire ect. Will the Anti-Counterfeiting Trade Agreement (ACTA) alter 'bot' behaviour to new areas isp use and account 'fixing'?
    Will isp's get powers to pop packets to note 'bot' behaviour early on, rather than seeing their ip's reported back days later?
    • Re: (Score:2, Insightful)

      by LordLucless (582312)

      Huh? ISPs already have this power. It's called "owning their infrastructure". If AISI stops providing accurate information, people will stop trusting it. This isn't a mandated cut-off - it's an advisory notice. ISPs aren't even obliged to pass it on.

      • by AHuxley (892839)
        If AISI stops providing accurate information, people will stop trusting it. This isn't a mandated cut-off - it's an advisory notice. ISPs aren't even obliged to pass it on.
        For now. Like when we had filter software for the desktop and now have the vision of a national filter, advisory and obliged can turn into monitor, log, warn and disconnect.
        Todays passive friendly note, is next years p2p watcher.
  • ISP accountability (Score:3, Interesting)

    by drDugan (219551) * on Monday June 07, 2010 @11:55PM (#32492226) Homepage

    It seems to me there is an accountability gap for ISPs. Those providing network connections are not held accountable for machines on their network. Yet another example of prices and business practices not matching the real costs of activities.

    To me, I would think the real solution, long term, to fixing botnets is creating a tight loop with internal scanning, reporting, warnings, verification, and then turning off Internet connection to machines that are infected. ISPs will need to be "motivated" to take responsibility for actions taken on their network, and they will have to have fully automated systems that take infected machines offline.

    It doesn't seem like this is a priority for ISPs yet. Its easier and cheaper to simply ignore the problem.

    • Re: (Score:3, Insightful)

      how would the ISP inform the customer that they've been infected?

      obviously web or email would just open them up to the usual phishing.

      • by sqrt(2) (786011)

        Once they lose their connection I have a feeling the customer will take care of initiating the necessary dialog :p

        • Re: (Score:1, Insightful)

          by Anonymous Coward

          Here's why an ISP won't do that (disconnect the customer)--because the customer WILL take care of it by SWITCHING ISPs. ISPs hope to MAKE money, not lose it. So they won't do something that drives customers away.

          Why should the ISP be responsible for a problem that is the customer's problem anyway?

          • by sqrt(2) (786011)

            And what if all the ISPs had a similar law? What if they were mandated to by the state? Sounds draconian but it just might force Microsoft and the end user to get their ducks in a row regarding security.

            • by Lennie (16154)

              Maybe it's just me, but I don't see how this would force Microsoft to do anything.

              People will just buy a newer Microsoft operating system or even a whole new computer, to 'fix' the problems they are having.

              • Furthermore the only real security microsoft could possibly enter to guarantee no viruses is a simple "signed code only" policy (you know, like the iPhone). After that, microsoft has a security-justified veto over what software can run on windows machines.

                Let's not propose cures that are far worse than the disease. This suggestion has about the same value as curing a painful toe by killing the patient.

                • by Lennie (16154)

                  The iPhone doesn't have a signed code only policy.

                  A quote: "Apple supports two platforms. First is HTML5, open and uncontrolled platform. He says the company fully supports it and behind it 100 percent - and stresses that it’s fully open. Second platform is the App Store — a curated platform with more than 225,000 apps and calls it the most vibrant app store on the planet. Interesting reference to curated as a asset of App Store."

                  The HTML5 isn't signed. ;-)

                  • Is this a joke ?

                    Imagine if microsoft would say : you can only install microsoft-approved applications, but we include a webbrowser.

                    Would you call that free ?

                    thought so

                  • by tepples (727027)

                    The HTML5 isn't signed. ;-)

                    But the HTML5 DOM exposed by Safari does not necessarily expose all useful hardware features. Good luck making an app that displays three-dimensional graphics in HTML5. Good luck making video chat over Wi-Fi in HTML5.

                    • by Sethumme (1313479)
                      HTML5 Quake [youtube.com]
                    • The iPhone doesn't have a signed code only policy. [...] The HTML5 isn't signed.

                      the HTML5 DOM exposed by Safari does not necessarily expose all useful hardware features.

                      HTML5 Quake [running on a Mac]

                      How many frames per second do you get on an iPhone running that app?

          • by JWSmythe (446288) <jwsmytheNO@SPAMjwsmythe.com> on Tuesday June 08, 2010 @12:41AM (#32492460) Homepage Journal

                You know, that's very true. Residential customers may stick with their provider (how many AOL users are still out there), but hosting customers will jump ship if they get disconnected. I had a friend who's SQL server got unplugged when a MSSQL worm was going around. It wasn't infected, but for the "safety of the datacenter" one of the techs walked around and pulled the power cord on any machine labeled "SQL". He called, and they couldn't resolve the problem. They said "we don't see anything wrong." When he got there, he found his machine was unplugged, just like quite a few other customers SQL boxes. Two days later, his equipment was in another datacenter.

          • by LingNoi (1066278)

            Since everyone on slashdot regularly complains that they don't have a choice in ISPs I doubt that'd be a problem and lets be honest, if a non-slashdot person got that kind of notification their first thought wouldn't be "i must change ISPs" it'd be either:

              1 - Lie to the ISP, "yeah it's fixed"
              2 - Panic and get their computer cleaned.

        • by Sancho (17056) *

          Really? Is it that easy to get ahold of your ISP? Around here, I'm lucky if I can get someone on the phone after 30 minutes on hold, and that's without hundreds of people calling about deactivations.

      • My ISP sends an e-mail to customers in this case. The e-mail says to contact the ISP.

        Yes there is a phishing risk, but given that most people don't expect these kinds of e-mails, there is not much more phishing risk than if they didn't send them. I'd be suspicious of an e-mail from my bank asking me for my password, regardless of whether my bank normally sends me such e-mails or not.

    • by Cylix (55374) * on Tuesday June 08, 2010 @12:07AM (#32492292) Homepage Journal

      The cost to the ISPs would be fairly significant. It's not simply the potential lost revenue from disabling unwitting users, but forcing the issue will also generate a good deal of customer interaction. Talking with customers will generally result in additional costs as well as dealing with potential infections.

      It's not an act of benevolence, but rather it is assuming responsibility. If you don't treat the issue for the customer then they may simply take the path of least resistance. ie, they may ultimately simply find another provider. Conversely, attempting to correct the problem will also result in issues as you now have the responsibility of restoring the customers computer to working order.

      Ultimately, all of these risks and more would have to outweigh the costs of fixing the problem. I'm glad I don't have to deal with these kinds of issues anymore because trying to pitch an act of altruism to the company owner probably would not have worked.

      With that said there are basically a few ways to approach the issue. Tighter regulation which states ISP's have to shepard their flock, fines on non-compliance or grants to award certain infection threshold reductions. In the end it really is about making one choice more expensive then the other.

      • by Splab (574204) on Tuesday June 08, 2010 @12:21AM (#32492370)

        BS, ISPs are just lazy. Here in Denmark at least a couple of the ISPs will actively block your connection if they detect botnet-like activity from your machine. When flagged any requests will be directed to a homepage where they tell you that you probably are infected and asks you to contact support for further assitance.

        • Re: (Score:3, Interesting)

          by Anonymous Coward

          It's a very dangerous route to go down. If all isps did that, I'm pretty sure that botnets would start encrypting their c&c data. Then what? If you just block all data you can't understand, say good-bye to vpn, legit p2p applications, and private communications between actual people.
          Of course, if you detect that your customers are ddosing some server, that's a different story.

          • by AHuxley (892839)
            Use banking ports and encryption :) With todays cpu's would the end user notice :)
          • Make darknets / honeypots to detect your customers trying to infect other hosts on your network(s). You are saying there is no point trying to fight infected machines that are part of bot nets because if you succeed in taking them down they will further improve the design of the botnet? And the alternative is?
            • by moeinvt (851793)

              " . . . And the alternative is?"

              Do your best evil laugh and go over to the dark side.

        • You mean... Their cut your connection, and will only restore it if you pay some extra fees? They'd better not do any mistake and cut a clean machine.
          • by Splab (574204)

            Where did you get that from? Where in my post does it suggest they charge customers for this?

            Botnet and spam activity cost bandwith, it's in the interest of the ISP to get rid of it - no one would dare charging for this service, when I worked in NOC for one of them we would happily guide you through installation of free anti virus and help you clean it up.

            You know, there are still countries in this world where companies try to satisfy their customers.

            • Yep, I misreaded it. When you said "asks you to contact support for further assitance", I instinctively assumed the support was paid. I can think companies may try to satisfy their customers, but ISP doing so is such an exotic concept, I didn't grasp it at first. That is bad :(
            • by Cylix (55374) *

              You are thinking in terms of small to no impact with such an administrative change. In any environment with a significantly large customer base this would be handled by customer service representatives. They will generally be trained and have material for troubleshooting connection issues.

              Now, you have to support removing or explaining why the infection is a problem and deal with the issue.

              Is it cheaper to allow the customer to consume bandwidth or deal with the problem? Since many organizations already hav

        • Dumb solution. ISPs are idiots. They detect valid mailing lists as 'botnet activity from your machine' No thanks. They give me a pipe and the bandwidth I pay for. They aren't the Internet Police. Maybe if they'd listen to customer complaints about other customer traffic, or better yet THEIR OWN. I once had a firewall crash because its log partition filled due to the raw amount of invalid DHCP traffic the ISP was spewing over the line from one of its own servers. And you want me to trust *THEM* with

          • by Splab (574204)

            Sounds like you are the moron my friend.

            1. This is for consumers, want something where you can freely spam, sorry, send out on mailing lists? Go buy a line designed for that. Don't know of any ISP in Denmark that let any traffic pass from consumer to port 25
            2. You claim to be such an avid user, yet your firewall crashes from something as simple as log entries?

            Your kind is the worst to support when you sit in the NOC, you know just enough to fuck up big time, jargo enough to get through level 1 and 2, yet ac

        • by Cylix (55374) *

          Having actually performed both as a system and network engineer role at a fairly large ISP in my youth it isn't any concept of being lazy.

          This is especially true when you get to larger corporate environments which translates a single decision effecting hundreds of thousands of customers. At a given level of customer volume even small changes have larger repercusions.

          Sure, if you have a lower then 5000 sub count you can get by with helping everyone fix their computer. It's not like the office will be fieldin

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        "...fines [fining ISPs] on non-compliance..."

        Why not fine the actual owner of the computer that's causing the problem? That would generate more motivation both to ISPs and end users. The user would seek an ISP that has excellent and quick detection and alerting facilities to protect him/her from fines. The user would be motivated to keep his/her machine more up-to-date. The user would have monetary motivation to purchase help if he/she can't administer his/her own computer effectively from someone compe

        • Why not fine the actual owner of the computer that's causing the problem?

          Great, except of course that it can only work by
          1) bringing all IP address assignments under government control, down to the individual user (translation : goodbye p2p, for obvious reasons)
          2) creating a world government that has enforcement capabilities in all internet-connected countries (translation : bye-bye piratebay, whereever you host, you get shot)
          3) obviously since this method has zero use unless truly every country participates, what are we going to do ? Attack any non-compliant government ? Discon

          • by Cylix (55374) *

            Slightly more on the extreme side, but some valid points as well.

            Once you create an infrastructure to easily identify everyone such an infrastructure would be abused to no end.

        • by Cylix (55374) *

          To identify a user would require a subpoena for the information.

          This would be a significant cost and undertaking across multiple jurisdictions. ie, the crime, detected in new york, but the bots would be scattered across the united states and globe. Also take note of the volume of dealing with 1000's of subpoenas across the nation.

          To me it seems like such a system with the current infrastructure would be more affordable to ignore.

          The point is it has to cost more to not treat the infection as opposed to the c

    • by girlintraining (1395911) on Tuesday June 08, 2010 @12:19AM (#32492356)

      It seems to me there is an accountability gap for ISPs. Those providing network connections are not held accountable for machines on their network.

      And the moment they do that, they'll be expected to police for other illegal or immoral activity, like video and music downloading, content monitoring, deep packet inspection, and more. The operating costs go up as well, making them less competitive compared to other ISPs that do not monitor their customer's habits.

      No, security needs to be managed by the owner of the machine. The ISP only has the responsibility to ensure that the customer has reasonable access through its networks, and perhaps a measure of QoS filtering/rate limiting/etc., to manage a shared (and limited) resource. Unless the bot is commanding the machine to use lots of network resources, its impact to other users is negligible from the ISPs perspective.

      • by tepples (727027)

        Unless the bot is commanding the machine to use lots of network resources, its impact to other users is negligible from the ISPs perspective.

        Except that in most cases I know about, the bot is in fact "commanding the machine to use lots of network resources".

    • by Urza9814 (883915) on Tuesday June 08, 2010 @12:37AM (#32492442)

      It seems to me there is an accountability gap for ISPs. Those providing network connections are not held accountable for machines on their network.

      And why should they be? If I sell you a fishing line, it isn't my job to ensure you don't choke somebody with it. Or for an even better analogy, look at the phone networks. Generally, if someone is calling you on the phone and harassing you, the phone company will not disconnect that person. They'll offer to change your number. It takes a _lot_ of complaints for them to cut off service to an offender. Same thing goes on the internet. Yes, botnets _will_ eventually be cut off, but it takes a lot of complaints. Otherwise, who decides what's malware?

      • But if you rent him a fishing line the situation might be different. Once he returns it you would be in possession of a murder weapon. Which part of your internet connection did the ISP sell to you?
        • by Urza9814 (883915)

          So? You aren't going to get arrested just because you happened to rent someone a tool and they used it to kill someone. I mean you might get arrested initially if they discover that you have the fishing line, but you'll be let go. I mean, assuming a perfect world and all (because this is all about what _should_ happen), you would prove you didn't have the fishing line at the time the guy was killed, and you would be released without any charges. Possession of a murder weapon isn't a crime.

          • The question is maybe more of what your responsibility is when you know somebody is at this moment using the fishing line to kill people. If you had a button you could press that would make the murder weapon vanish, should you just shrug as you won't be prosecuted anyway?
    • by FrankieBaby1986 (1035596) on Tuesday June 08, 2010 @12:38AM (#32492450)

      They do exactly that at my University. Students get disconnected from the network when a bot or worm or rootkit is detected. I'm not sure what methods they use to detect, but when this happens, the user is REQUIRED to bring their computer to the Residential Computing Desk and have it reformatted. (They are allowed to and assisted with make(ing) backups of their personal files.)

      The users are sent an email informing them of the situation, but usually they never get it, and just visit or call the desk when their internet won't work.

      It's always pretty funny (but rare) when a Mac needs to be reformatted, the user is almost always blown away that they can be infected.

      • by Sancho (17056) *

        They are almost certainly just using some sort of IDS (or "network virus scanner", which amounts to the same thing in the security appliance world.) Unfortunately, these are usually fairly prone to false positives. It wouldn't surprise me at all if the Macs that were caught were falses.

        Skype, for some reason, really throws our IDS for a loop. Whenever a machine that has just been reimaged triggers our IDS, invariably the user had started Skype just before the alert was triggered. But other software caus

      • Specifically, what Mac infections have you found and had to reformat the drive to remove?
        • To both my HelpDesk and the User's frustrations, the only information the lockout system gives us is usually "Misc Bot" or "Misc Bots". It sucks having to tell users that when they ask just why they need to be reformatted.
      • by operagost (62405)

        Students get disconnected from the network when a bot or worm or rootkit is detected. I'm not sure what methods they use to detect, but when this happens, the user is REQUIRED to bring their computer to the Residential Computing Desk and have it reformatted.

        God forbid you get a false positive and they wipe out your machine for it. It seems like every major AV marks remote administration programs as malicious backdoors now.

    • by zix619 (802964)
      By analogy to viruses and human beings, in any human society sick people (infected by viruses) go around the city without being bothered, nobody will ask the public transport system to scan the users and bar sick people from taking the bus in order not to infect other people in the bus. this should be the same for ISPs! Just in case of very malicious behavior the ISP should intervene to bar access to its network!
  • by RobertSeattle (1345313) on Monday June 07, 2010 @11:55PM (#32492234)
    My small 16 person company gets an average of 300K Directory Harvesting emails a day - everyday - day in day out. All I have to say is I appreciate the jerks running the botnets for not killing my domain with 30 Million of these a day. They throttle their crap to a certain level somehow so they are annoying but not crippling. Gee, thanks, I guess.
    • by noz (253073) on Tuesday June 08, 2010 @12:34AM (#32492430)

      There's no point sending any spam, if not your estimated 30 million messages, only to collapse the server and not relay the messages to the recipients.

      The botnet operators probably think of this as an optimization problem and not good manners.

    • Re: (Score:3, Interesting)

      by JWSmythe (446288)

          Tie your spam filtering software into your firewall. Nothing says loving like dropping their inbound traffic. :) We only receive about 20k spams/day now (versus more than 300k before), just by having rolling blacklists based on spammy inbound traffic. You'll get a handful through, but nothing else will come in for days.

      • Re: (Score:2, Insightful)

        by timmarhy (659436)
        you can go one better and implement a tarpit which actually costs the spammer money by delaying their emails. every second they are delayed is a second they can't spam another mail server frustrating their efforts. http://en.wikipedia.org/wiki/Tarpit_(networking) [wikipedia.org]
        • by Fumus (1258966)

          I'm not really knowledgeable about e-mail servers so I can't tell it from the wikipedia article. Does this method work only for computers sending out spam, or can it be run on everyone's server and cause spam-bots to slow down noticeably? If the latter, I'm surprised it's not standard practice worldwide.

  • Efficiency (Score:3, Interesting)

    by w00tsauce (1482311) on Tuesday June 08, 2010 @12:26AM (#32492388)
    I for one think botnets are uber cool, a testament to the efficiency of the internet. Using computers that would normally sit idle to do something, even if it's detrimental is just plain cool. I also think botnets foreshadow the future of the internet, where most applications work by p2p instead of the normal client-server relationship.
  • Sadly no.

    It turns out even botnetters haven't yet figured out a good use for Mozilla's Ubiquity extension.

  • by identity0 (77976) on Tuesday June 08, 2010 @12:39AM (#32492456) Journal

    top-down C&C infrastructures, like those employed throughout the 1990s

    My C&C keeps going down because the &*#$ing Harvester goes after Tiberium next to the enemy tanks :(

    With many botnet operators maintaining dozens or sometimes hundreds of C&C servers around the world at any one time

    Oh I wish.

    • Re: (Score:1, Informative)

      by Anonymous Coward

      My C&C goes down when the other guy builds Mammoth Tanks on the same grid location as his Tesla Coil.

    • by moz25 (262020)

      Funniest thing I've read all day.

  • Bring back the biff! (Score:3, Informative)

    by Puff_Of_Hot_Air (995689) on Tuesday June 08, 2010 @04:56AM (#32493552)
    Years ago, virii held more fear to the average punter as they would literally trash your o/s, data, everything. The thing is, these viruses did far less real damage than the trojans and botnets of today. We need some well meaning black hats to write some old school virii. Viruses that knock those old unpatched boxes right of the web. It's time we brought back the biff!
  • I wonder, when they gain sanity and rise against their puny human masters,

  • Sounds like botnet owners read Ender's Game.
  • So you are telling me instead of loading all the botnets with just a script to log on and receive commands, that a lot of them now are also quasi C&C centers...wow, imagine that, who would have thought, instead of making just drones, they are making more generals too....sounds a lot like C&C (command and conquer) strategy.... ; )

    I always though the best botnet would be would compromised machines that uses torrent abilities to get pieces of itself that is still missing, but start with smaller parts,

  • Decentralization makes things more robust. I think we've known that for about two decades now.

You can do more with a kind word and a gun than with just a kind word. - Al Capone

Working...